Taskfile.yml

# yaml-language-server: $schema=https://taskfile.dev/schema.json
---
version: "3"

set:
  - pipefail

run: once

env:
  CGO_ENABLED: "0"
  GOTOOLCHAIN:
    sh: echo "go$(sed -n 's/^go //p' go.mod | head -1)"

vars:
  BIN_DIR: bin
  # renovate: datasource=github-releases depName=go-task/task
  TASK_VERSION: "3.51.1"
  # renovate: datasource=github-releases depName=kubernetes-sigs/kind
  KIND_VERSION: v0.32.0
  # renovate: datasource=github-releases depName=FiloSottile/mkcert
  MKCERT_VERSION: v1.4.4
  # renovate: datasource=github-releases depName=hashicorp/terraform
  TERRAFORM_VERSION: "1.15.5"
  # renovate: datasource=github-releases depName=orhun/git-cliff
  GIT_CLIFF_VERSION: v2.13.1
  GIT_CLIFF_BIN: "{{.BIN_DIR}}/git-cliff"
  GO_ARCH_LINT_CONFIG: hack/tooling/go-arch-lint.yml
  # renovate: datasource=github-releases depName=fe3dback/go-arch-lint
  GO_ARCH_LINT_VERSION: v1.15.0
  MANAGER_BINARY: "{{.BIN_DIR}}/manager"
  DOCKER_IMAGE: mkurator-controller-manager:dev
  CLUSTER_NAME:
    sh: echo "${CLUSTER_NAME:-mkurator}"
  KUBECONFIG:
    sh: |
      ROOT="$(git rev-parse --show-toplevel)"
      KIND_KUBECONFIG="${ROOT}/hack/kind-cluster/.state/kubeconfig.yaml"
      if [ -n "${KUBECONFIG:-}" ] && [ -f "${KUBECONFIG}" ]; then
        echo "${KUBECONFIG}"
      else
        echo "${KIND_KUBECONFIG}"
      fi
  KUSTOMIZE:
    sh: go tool -n kustomize
  MARKDOWNLINT_CONFIG: hack/tooling/markdownlint-cli2.yaml

includes:
  cluster:
    taskfile: ./hack/kind-cluster/Taskfile.yml
    dir: ./hack/kind-cluster
  test:
    taskfile: ./Taskfile.test.yml

tasks:
  default:
    desc: Show available tasks
    cmds:
      - task --list-all
    silent: true

  install:
    desc: Download and verify Go module dependencies
    cmds:
      - go mod download
      - go mod verify

  format:
    desc: Auto-fix Go formatting (gofmt, goimports, golines, golangci-lint --fix)
    deps: [install]
    cmds:
      - bash hack/goformat.sh
      - go tool golangci-lint run --fix ./...

  lint:
    desc: Run golangci-lint v2 and go-arch-lint
    deps: [install]
    cmds:
      - go tool golangci-lint run ./...
      - task: arch:lint

  arch:lint:
    desc: Enforce internal/ package dependency graph (go-arch-lint)
    cmds:
      - go run -mod=mod github.com/fe3dback/go-arch-lint@{{.GO_ARCH_LINT_VERSION}} check --arch-file {{.GO_ARCH_LINT_CONFIG}}

  lint:markdown:
    desc: Lint Markdown docs with markdownlint-cli2
    cmds:
      - npm ci --prefix docs
      - docs/node_modules/.bin/markdownlint-cli2 --config {{.MARKDOWNLINT_CONFIG}}

  lint:shell:
    desc: Lint shell scripts with ShellCheck
    cmds:
      - bash hack/lint-shell.sh

  audit:rbac:
    desc: Audit operator RBAC with Polaris and kubeaudit
    cmds:
      - bash hack/audit-rbac.sh

  manifests:
    desc: Generate CRDs, RBAC, and webhook configuration
    deps: [install]
    cmds:
      # Only v1beta1 exists. CRD/webhook codegen runs over the v1beta1 API +
      # v1beta1 webhook packages so controller-gen emits single-version CRDs;
      # deepcopy runs over ./api/... in the generate task.
      - go tool controller-gen rbac:roleName=manager-role crd webhook paths="./api/v1beta1/...;./internal/controller/...;./internal/webhook/v1beta1/...;./cmd/..." output:crd:artifacts:config=config/crd/bases

  generate:
    desc: Generate deepcopy and other codegen
    deps: [install]
    cmds:
      - go tool controller-gen object:headerFile="hack/boilerplate.go.txt" paths="./api/..."
      - task: test:generate

  docs:crd-ref:
    desc: Regenerate per-CRD reference field tables (crd-ref blocks in docs/crds/*.md) from config/crd/bases
    cmds:
      - go run ./hack/tools/crd-ref-gen

  verify:
    desc: Fail if generated artifacts (manifests, deepcopy, mocks, CRD reference docs) are stale
    deps: [install]
    cmds:
      - bash hack/verify.sh

  secrets:scan:
    desc: Scan git history for hardcoded secrets (gitleaks)
    cmds:
      - gitleaks detect --source . --verbose

  scrub:
    desc: Fail if staged files contain forbidden employer or legacy-project strings
    cmds:
      - bash hack/scrub.sh

  scrub:tree:
    desc: Fail if any tracked file contains forbidden employer or legacy-project strings (CI net)
    cmds:
      - bash hack/scrub-tree.sh

  vuln:check:
    desc: Run govulncheck against code and dependencies
    deps: [install]
    cmds:
      - go tool govulncheck ./...

  build:
    desc: Build the manager binary (CGO-free, static)
    deps: [install]
    cmds:
      - go build -ldflags="-w -s" -o {{.MANAGER_BINARY}} ./cmd/main.go
    sources:
      - "**/*.go"
      - go.mod
      - go.sum
    generates:
      - "{{.MANAGER_BINARY}}"

  docker:build:
    desc: Build the controller-manager container image
    deps: [build]
    cmds:
      - "{{.CONTAINER_TOOL | default `docker`}} build -t {{.DOCKER_IMAGE}} ."

  install:crds:
    desc: Apply CRD manifests to the cluster (e2e/local)
    cmds:
      - kubectl apply --server-side -k config/crd
    env:
      KUBECONFIG: "{{.KUBECONFIG}}"

  deploy:operator:
    desc: Deploy operator manifests without rebuilding the image (assumes image is loaded)
    cmds:
      - |
        cd config/manager && {{.KUSTOMIZE}} edit set image controller={{.DOCKER_IMAGE}}
      - kubectl apply --server-side --force-conflicts -k config/default
    env:
      KUBECONFIG: "{{.KUBECONFIG}}"

  undeploy:operator:
    desc: Remove operator manifests and CRDs from the cluster (non-blocking; deletes CR instances first)
    cmds:
      - |
        for ns in mkurator-e2e-queues mkurator-e2e-topics mkurator-e2e-channels mkurator-e2e-auth mkurator-system; do
          kubectl delete queues,topics,channels,channelauthrules,authorityrecords,queuemanagerconnections --all -n "$ns" --ignore-not-found --wait=false || true
        done
      - kubectl delete --ignore-not-found -k config/default --wait=false --timeout=2m
      - kubectl delete --ignore-not-found -k config/crd --wait=false --timeout=2m
    env:
      KUBECONFIG: "{{.KUBECONFIG}}"

  format:check:
    desc: Fail if Go formatting differs from task format output
    deps: [install]
    cmds:
      - bash hack/goformat.sh
      # Generated artifacts (controller-gen, mockery) are owned by task verify, not goimports.
      - git checkout -- api/*/zz_generated.deepcopy.go test/mocks/
      - git diff --exit-code -- '*.go'

  deploy:
    desc: Build image, load into kind (if present), apply CRDs + operator (Kustomize)
    deps: [docker:build]
    cmds:
      - |
        if command -v kind >/dev/null 2>&1 && kind get clusters 2>/dev/null | grep -qx "{{.CLUSTER_NAME}}"; then
          kind load docker-image {{.DOCKER_IMAGE}} --name "{{.CLUSTER_NAME}}"
        fi
      - task: install:crds
      - task: deploy:operator
    env:
      KUBECONFIG: "{{.KUBECONFIG}}"

  deploy:helm:operator:
    desc: Install operator via Helm chart without rebuilding the image (assumes image is loaded)
    deps: [helm:sync-crds]
    cmds:
      - |
        E2E_VALUES=""
        if [ "${KURATOR_E2E_DEPLOY:-}" = "helm" ]; then
          E2E_VALUES="-f ./charts/mkurator/samples/values-e2e.yaml"
        fi
        helm upgrade --install mkurator ./charts/mkurator \
          --namespace mkurator-system \
          --create-namespace \
          -f ./charts/mkurator/samples/values-kind.yaml \
          ${E2E_VALUES} \
          --set image.repository={{.DOCKER_IMAGE | splitList ":" | first}} \
          --set image.tag={{.DOCKER_IMAGE | splitList ":" | last}} \
          --wait --timeout 5m
    env:
      KUBECONFIG: "{{.KUBECONFIG}}"

  deploy:helm:
    desc: Build image, load into kind, install operator via Helm chart (local dev)
    deps: [docker:build, helm:sync-crds]
    cmds:
      - |
        if command -v kind >/dev/null 2>&1 && kind get clusters 2>/dev/null | grep -qx "{{.CLUSTER_NAME}}"; then
          kind load docker-image {{.DOCKER_IMAGE}} --name "{{.CLUSTER_NAME}}"
        fi
      - |
        E2E_VALUES=""
        if [ "${KURATOR_E2E_DEPLOY:-}" = "helm" ]; then
          E2E_VALUES="-f ./charts/mkurator/samples/values-e2e.yaml"
        fi
        helm upgrade --install mkurator ./charts/mkurator \
          --namespace mkurator-system \
          --create-namespace \
          -f ./charts/mkurator/samples/values-kind.yaml \
          ${E2E_VALUES} \
          --set image.repository={{.DOCKER_IMAGE | splitList ":" | first}} \
          --set image.tag={{.DOCKER_IMAGE | splitList ":" | last}} \
          --wait --timeout 5m
    env:
      KUBECONFIG: "{{.KUBECONFIG}}"

  deploy:samples:
    desc: Apply sample Secret + all CRs (requires operator CRDs; use after deploy:helm)
    cmds:
      - kubectl create namespace mkurator-system --dry-run=client -o yaml | kubectl apply -f -
      - kubectl apply --server-side -k charts/mkurator/samples/resources/
    env:
      KUBECONFIG: "{{.KUBECONFIG}}"

  undeploy:
    desc: Remove operator install manifests from the cluster (Kustomize)
    cmds:
      - kubectl delete --ignore-not-found -k config/default
    env:
      KUBECONFIG: "{{.KUBECONFIG}}"

  undeploy:helm:
    desc: Uninstall Helm release and sample CRs
    cmds:
      - kubectl delete --ignore-not-found -k charts/mkurator/samples/resources/
      - helm uninstall mkurator --namespace mkurator-system || true
    env:
      KUBECONFIG: "{{.KUBECONFIG}}"

  helm:sync-crds:
    desc: Copy config/crd/bases into charts/mkurator/crds
    cmds:
      - bash hack/helm-sync-crds.sh

  samples:sync:
    desc: Sync config/samples CR YAML into charts/mkurator/samples/resources
    cmds:
      - bash hack/sync-samples.sh

  helm:lint:
    desc: Lint the publishable MKurator Helm chart and verify admission webhook, RBAC, and CRD templates
    cmds:
      - helm lint ./charts/mkurator
      - bash hack/helm-verify-admission.sh
      - bash hack/helm-verify-rbac.sh
      - bash hack/helm-verify-crds.sh

  helm:test:
    desc: Run helm-unittest specs against charts/mkurator (requires the helm-unittest plugin)
    cmds:
      - helm unittest ./charts/mkurator

  helm:package:
    desc: Package charts/mkurator to dist/
    deps: [helm:sync-crds]
    cmds:
      - mkdir -p dist
      - helm package ./charts/mkurator -d dist/

  local:up:
    desc: "Local dev: kind cluster + IBM MQ + operator (Helm) + sample CRs"
    cmds:
      - task: cluster:up
      - task: deploy:helm
      - task: deploy:samples
      - task: local:info

  local:deploy:
    desc: "Install operator + sample CRs on an existing local cluster (skip cluster:up)"
    cmds:
      - task: deploy:helm
      - kubectl rollout restart deployment/mkurator-controller-manager -n mkurator-system
      - kubectl rollout status deployment/mkurator-controller-manager -n mkurator-system --timeout=5m
      - task: deploy:samples

  local:info:
    desc: Print local cluster URLs, MQ credentials, and MKurator resource status
    cmds:
      - task: cluster:info
      - |
        echo ""
        echo "MKurator (namespace mkurator-system):"
        kubectl get deploy,pods -n mkurator-system 2>/dev/null || true
        kubectl get qmc,mq,tp,chl -n mkurator-system 2>/dev/null || true
        echo ""
        echo "Quick check:"
        echo "  task mq:runmqsc -- \"DISPLAY QLOCAL('APP.ORDERS') MAXDEPTH\""
        echo "  task mq:runmqsc -- \"DISPLAY TOPIC('RETAIL.ORDERS') TOPSTR\""
        echo "  task mq:runmqsc -- \"DISPLAY CHANNEL('ORDERS.APP') CHLTYPE(SVRCONN)\""
        echo "Guide: docs/IBM_MQ_101.md"
    env:
      KUBECONFIG: "{{.KUBECONFIG}}"

  mq:console:
    desc: Print IBM MQ web console URL and credentials (kind cluster)
    cmds:
      - task: cluster:mq:console

  mq:cli:
    desc: Interactive runmqsc on kind cluster queue manager QM1
    cmds:
      - task: cluster:mq:cli

  mq:runmqsc:
    desc: Run one MQSC command on kind QM1 (pass command after --)
    cmds:
      - task: cluster:mq:runmqsc
        vars:
          CLI_ARGS: "{{.CLI_ARGS}}"

  mq:integration:up:
    desc: Start standalone IBM MQ in Docker for integration tests
    cmds:
      - docker compose -f hack/mq-docker/docker-compose.yml up -d

  mq:integration:wait:
    desc: Wait until mqweb is ready on localhost:9443 (Docker integration MQ)
    cmds:
      - bash hack/mq-docker/wait-mqweb.sh

  mq:integration:down:
    desc: Stop Docker integration MQ container
    cmds:
      - docker compose -f hack/mq-docker/docker-compose.yml down

  mq:swagger:fetch:
    desc: Fetch mqweb Swagger 2.0 JSON from a running queue manager
    env:
      MQWEB_USER: "{{.MQWEB_USER | default \"admin\"}}"
      MQWEB_PASS: "{{.MQWEB_PASS | default \"passw0rd\"}}"
      MQWEB_INSECURE: "{{.MQWEB_INSECURE | default \"1\"}}"
      KURATOR_INTEGRATION_MQ_ENDPOINT: "{{.KURATOR_INTEGRATION_MQ_ENDPOINT | default \"https://127.0.0.1:9443\"}}"
    cmds:
      - bash scripts/fetch-mqweb-swagger.sh "${KURATOR_INTEGRATION_MQ_ENDPOINT}" docs/schemas/mqweb-swagger.json

  local:down:
    desc: "Tear down sample CRs, Helm release, and kind cluster"
    cmds:
      - task: undeploy:helm
      - task: cluster:down

  ci:e2e:
    desc: "E2E parity with GitHub Actions (cluster:up, MQ wait, test:e2e)"
    env:
      CGO_ENABLED: "1"
      CERT_MANAGER_INSTALL_SKIP: "true"
      KURATOR_E2E_MQ: "1"
      KIND_CLUSTER: "{{.CLUSTER_NAME}}"
      KUBECONFIG: "{{.KUBECONFIG}}"
    cmds:
      - bash hack/ci/run-ci-e2e.sh

  ci:integration:
    desc: "Integration test parity with GitHub Actions (Docker MQ up, test, down)"
    env:
      # Integration suite runs `go test -race`, which requires cgo. The global
      # env defaults CGO_ENABLED=0; without this override the value is exported
      # into run-ci-integration.sh and the nested `task test:integration`, so
      # `go test -race` fails "requires cgo". Mirrors ci:e2e above. (Kept the
      # weekly Nightly integration job red once the go-cache fix unmasked it.)
      CGO_ENABLED: "1"
    cmds:
      - bash hack/ci/run-ci-integration.sh

  tools:check:
    desc: Verify dev tools for tier A/B/C (TOOLS_TIER env, default C)
    cmds:
      - bash hack/tools-check.sh

  tools:install:
    desc: Download CI-pinned kind, mkcert, task, terraform into bin/
    cmds:
      - bash hack/install-external-tool.sh kind {{.KIND_VERSION}} {{.BIN_DIR}}/kind
      - bash hack/install-external-tool.sh mkcert {{.MKCERT_VERSION}} {{.BIN_DIR}}/mkcert
      - bash hack/install-external-tool.sh task v{{.TASK_VERSION}} {{.BIN_DIR}}/task
      - bash hack/install-external-tool.sh terraform {{.TERRAFORM_VERSION}} {{.BIN_DIR}}/terraform
      - |
        echo "Installed into {{.BIN_DIR}}/ — add to PATH: export PATH=\"$(pwd)/{{.BIN_DIR}}:\$PATH\""
        echo "Then run: task tools:check"

  tools:git-cliff:
    desc: Download pinned git-cliff binary ({{.GIT_CLIFF_VERSION}})
    status:
      - test -x {{.GIT_CLIFF_BIN}}
    cmds:
      - bash hack/install-git-cliff.sh {{.GIT_CLIFF_VERSION}} {{.GIT_CLIFF_BIN}}

  changelog:
    desc: Preview unreleased changelog section (stdout)
    deps: [tools:git-cliff]
    cmds:
      - "{{.GIT_CLIFF_BIN}} --config cliff.toml --unreleased -o -"

  changelog:write:
    desc: Regenerate CHANGELOG.md from git tags and unreleased commits
    deps: [tools:git-cliff]
    cmds:
      - "{{.GIT_CLIFF_BIN}} --config cliff.toml -o CHANGELOG.md"

  changelog:release:
    desc: Print changelog section for the latest tag (release notes)
    deps: [tools:git-cliff]
    cmds:
      - "{{.GIT_CLIFF_BIN}} --config cliff.toml --latest -o -"